feat: add GitHub event integration health panel

packages/daemon/src/lib/external-events/github/github-repository.ts

@@ -58,6 +58,29 @@ export interface PollCursor {
    * Committed into `endpointLastSeenAt` only once the endpoint backlog clears.
    */
   endpointPendingLastSeenAt?: Record<string, number>;
+  /**
+   * Set when the most recent poll cycle could not access this repo (e.g. a
+   * valid-but-unauthorized PAT returning 403/404 on every endpoint), and cleared
+   * on a cycle that reached any accessible (200/304) endpoint. Used by the
+   * health rollup so a polling repo that cannot publish is not treated as a
+   * live delivery path. Null/absent before the first poll or after a rate-limit
+   * break with no access attempt.
+   */
+  lastPollError?: string | null;
+  /**
+   * Set when the most recent cycle reached some endpoints but a later required
+   * one failed (partial access — e.g. a fine-grained PAT with issue-comment but
+   * no pull-request access). Cleared on a fully successful or fully failed
+   * cycle. Partial traffic still publishes, so this is a Degraded, not Down.
+   */
+  lastPartialPollError?: string | null;
+  /**
+   * Wall-clock epoch of the most recent cycle that actually issued a reaction
+   * request (not merely a poll that advanced lastPollAt). Reactions are skipped
+   * when the rate-limit budget is tight, so lastPollAt would otherwise over-
+   * state reaction freshness.
+   */
+  lastReactionPollAt?: number | null;
 }
 
 export interface GitHubWatchedRepo {
@@ -263,7 +286,8 @@ export class GitHubEventExtensionRepository {
         `UPDATE space_github_watched_repos
          SET webhook_secret = CASE WHEN ? THEN NULL ELSE webhook_secret END,
              webhook_remote_id = NULL, webhook_url = NULL, webhook_auto_registered = 0, webhook_active = NULL,
-             webhook_last_checked_at = NULL, webhook_last_error = NULL, webhook_configured_at = NULL, updated_at = ?
+             webhook_last_checked_at = NULL, webhook_last_error = NULL, webhook_configured_at = NULL,
+             last_webhook_at = NULL, updated_at = ?
          WHERE id = ?`
       )
       .run(options.clearSecret ? 1 : 0, Date.now(), id);